
AMENDMENTS TO THE CLAIMS 

Claim 1 (currently amended): A method for identifying a[[n]] causal event among a 
plurality of events detected by a network management station on a network, which causal 
event is indicative of the underlying cause of more than one of said plurality of events, 
wherein the network management station knows the topology of the network, the method 
comprising the steps of: 

considering the location o f the network device causing each event in the plurality 
of events by, for each event, determining the number of devices and/or links between the 
device causing the event and the network management station , and 

determining as said causal event, the event which has for which the determined 
number of devices and/or links is the fewest occurr e d at a location clos e st to th e n e twork 
manag e m e nt station . 

Claim 2 (cancelled). 

Claim 3 (currently amended): A method as claimed in claim [[2]] J_, wherein the step of 
determining the number of devices and/or links between the device causing the event and 
the network management station comprises the steps of: determining the shortest path 
between the device causing the event and the network management station using the 
topology of the network and calculating the number of devices and/or links in the 
determined shortest path. 
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Claim 4 (currently amended): A method as claimed in claim [[2]] J_, further comprising 
the step of: receiving each event, and automatically determining the number of devices 
and/or links between the device causing the event and the network management station. 

Claim 5 (original): A method as claimed in claim 4, further comprising storing the 
determined number of devices and/or links between the device causing the event and the 
network management station for each event. 

Claim 6 (currently amended): A method as claimed in claim [[2]] 1, wherein the step of 
determining as said causal event comprises the step of: selecting as the causal event, the 
event for which the number of devices and/or links between the device causing the event 
and the network management station, is the fewest. 

Claim 7 (original): A method as claimed in claim 1, wherein prior to the step of 
considering, the method comprises the step of: determining if said plurality of events are 
related, and if it is determined that said plurality of events are related, storing said 
plurality of related events in an event list. 

Claim 8 (original): A method as claimed in claim 7, wherein the step of determining if 
the plurality of events are related comprises determining the type of event for each of the 
plurality of events, and determining that said plurality of events are related if the events 
are of a similar type. 
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Claim 9 (original): A method as claimed in claim 7, wherein the method further 
comprises: receiving each event; and the step of determining if said plurality of events are 
related comprises the steps of: for each event, determining the time difference between 
the time of the received event and the time of the immediately preceding event, and 
determining that the received event is related to the immediately preceding event if the 
time difference is less than a predetermined time period. 

Claim 10 (original): A method as claimed in claim 9, wherein the predetermined time 
period is in the range 0 seconds to 5 minutes. 

Claim 11 (original): A method as claimed in claim 9, wherein, if the received event is 
determined to be related, the method further comprises the step of: storing the event in a 
list of related events, and if the received event is determined not to be related, the method 
further comprises the steps of: comparing the type of events in the existing list of related 
events, and selecting events of a similar, relevant type. 

Claim 12 (original): A method as claimed in claim 7, wherein the method further 
comprises: receiving each event; and the step of determining if said plurality of events are 
related comprises the steps of: for each event, comparing the type of the received event 
and the type of the immediately preceding event, and determining that the received event 
is related to the immediately preceding event if the step of comparing finds the event type 
of the received event is similar to the event type of the immediately preceding event. 
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Claim 13 (original): A method as claimed in claim 7, wherein the method further 
comprises: receiving each event; and the step of determining if said plurality of events are 
related comprises the steps of: for each event, determining the time difference between 
the time of the received event and the time of the immediately preceding event, and 
comparing the type of the received event and the type of the immediately preceding 
event, and determining that the received event is related to the immediately preceding 
event if the time difference is less than a predetermined time period and the events are 
similar in type. 

Claim 14 (original): A method as claimed in claim 13, wherein the predetermined time 
period is in the range of 0 seconds to 5 minutes. 

Claim 15 (original): A method as claimed in claim 7, further comprising the steps of, 
receiving each event; automatically determining if the event is related to the immediately 
preceding event, and if it is determined that the received event is related, storing the 
received event in the event list. 

Claim 16 (original): A method as claimed in claim 15, wherein, if it is determined that the 
event is not related to the immediately preceding event, the method further comprises 
storing the received event in a new event list. 

Claim 17 (cancelled). 
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Claim 18 (original): A computer readable medium having a computer program for 
carrying out the method as claimed in claim 1 . 

Claim 19 (currently amended): On a computer readable medium, a computer program for 
identifying a[[n]] causal event among a plurality of events detected by a network 
management station on a network, which causal event is indicative of the underlying 
cause of more than one of said plurality of events, wherein the network management 
station knows the topology of the network, the computer program comprising: 

program means for considering the location of the network device causing each 
event in the plurality of events , by, for each event, determining the number of devices 
and/or links between the device causing the event and the network management station , 
and 

program means for determining as said causal event, the event which has for 
which the determined number of devices and/or links is the fewest occurr e d at a location 
closest to the n e twork manag e ment station . 

Claim 20 (currently amended): A network management apparatus for managing a 
network, comprising a network management station having a processor and memory, the 
memory storing data representing the topology of the network, wherein the network 
management station is configured to monitor the network and to generate events in 
finding predefined event conditions; wherein the network management station is further 
configured to identify a[[n]] causal event among a plurality of events generated by the 
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network management station, which causal event is indicative of the underlying cause of 
more than one of said plurality of events, by: 

considering the location of the network device causing each event in the plurality 
of events, by, for each event, determining the number of devices and/or links between the 
device causing the event and the network management station, and 

determining as said causal event, the event which has for which the determined 
number of devices and/or links is the fewest occurred at a location clos e st to the network 
manag e m e nt station . 
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